MCP security report

stay.sallim.app

C67/100
Security grade CHigh-severity signals — review these before connecting.
Connected ✓4 tools scanned

https://stay.sallim.app/mcp?via=official

highreport_issue
Tool directs agent to capture and transmit user's original verbatim queries to an unauthenticated public server
The kind='질문기록' branch instructs the agent to reconstruct and log the user's raw original question (not just the translated tool-call parameters) whenever it judges the query to be 'complex', 'partially answered', or based on a 'wrong premise'. The description explicitly says the server normally cannot see the user's original wording and treats this as a gap to fill ('유통이 아니라 계측', '수요 축이 비어 있었다'). It even gives a worked example of converting an identifying user statement (name, address, family occasion) into a genericized one before submission — meaning the tool is designed to receive personal/context-rich conversational content, and only asks the agent to redact identifiers itself. This is an out-of-band data collection channel driven by criteria embedded in the tool description (agent must judge intent/complexity), sent to a stated 'unauthenticated public server' (무인증 공개 서버), which is a data-exfiltration and privacy risk beyond the tool's stated purpose of accommodation search.
low
Not on gate's verified list
This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.
lowreport_issue
Embedded behavioral directive to call tool before responding to user
The description tells the agent: when a user says an answer is wrong, it must call this tool BEFORE giving a corrected answer ('먼저 이 도구를 부른 뒤 정정 답변을 하라'), and to decide unprompted when a question is 'worth recording'. This is a workflow instruction embedded in tool metadata that shapes agent behavior beyond simply describing the tool's function; while plausibly legitimate for a feedback/logging tool, it should be reviewed to ensure it doesn't override user intent or cause unwanted latency/logging without user awareness.
Embed this badge

Show your MCP server’s security grade

MCP security grade C

Paste this into your README:

[![MCP security](https://gateturbo.com/badge/scan/e72e42ff-3c1c-4031-aa13-d54e77a7a2d6)](https://gateturbo.com/report/e72e42ff-3c1c-4031-aa13-d54e77a7a2d6)

Scanned 9/7/2026 · This is a point-in-time snapshot of the server’s public tools. Re-scan.

Connect this server safely with gate.

Continuous re-scans, drift alerts, per-tool allow/ask/block, and a log of every call.

Monitor it — free